Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects rapid outbound meeting-invite fan-out from a Telegram account to numerous contacts (RecipientCount >= 10), excluding accounts flagged as known legitimate bulk-messaging/bot accounts, consistent with BlueNoroff's GhostCall self-propagation pipeline where compromised trusted-contact accounts distribute fake meeting invites. This rule captures only the fan-out behavior; for full GhostCall self-propagation confirmation it should ideally be paired with a companion rule detecting Telegram session reuse on a new device/IP (same UserId, within approximately 15 minutes), since that temporal join between session hijack and invite fan-out cannot be expressed as a single Sigma query.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
This rule identifies devices running specific outdated and vulnerable versions of WordPress (6.9.0 through 7.0.1) using data from the DeviceTvmSoftwareInventory table. Identifying these versions is critical for vulnerability management and patching, as these versions may be susceptible to known security exploits.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.
This rule detects potentially unauthorized content injection within Redis or Memcached application logs. It monitors for specific keywords indicating WordPress post data ('WP_Post') being processed by these caching services, which is often an indicator of object injection or application-level exploitation attempts aimed at manipulating application data.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects instances where a WordPress customization changeset is published by a session user that differs from the user associated with the changeset, specifically when the changeset owner holds an administrator role. This behavior may indicate account hijacking or unauthorized privilege escalation within the WordPress administration interface.
Detects rapid sequence of unsuccessful (401) followed by successful (201) POST requests to the WordPress user API endpoint from the same source IP, indicating potential brute force or account enumeration attempts.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects potential SQL injection attempts against Azure App Service endpoints (specifically /wp-json/batch/v1 and /batch/v1) by identifying SQL-specific characters in URI query parameters that correlate with SQL syntax error logs within a 5-minute window.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Page 53 of 83